{"id":"EUVD-2026-29175","enisaUuid":"217ac65b-5fa0-397f-a2d9-b7e07201984e","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","datePublished":"May 11, 2026, 5:49:42 PM","dateUpdated":"May 11, 2026, 6:21:09 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c\n","aliases":"CVE-2026-43995\nGHSA-qqvm-66q4-vf5c\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"c496e96a-3285-32a0-8f80-8dbc1c534a8d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"enisaIdVendor":[{"id":"bfdcd0aa-48ff-399c-bac2-270e335bcefa","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"bbb1ea1f-e918-3fde-a1e3-2e8d0dc9e10a","vulnerability":{"id":"GHSA-qqvm-66q4-vf5c","description":"Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)","datePublished":"Apr 16, 2026, 9:23:03 PM","dateUpdated":"May 13, 2026, 2:04:45 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43995\nhttps://github.com/FlowiseAI/Flowise\n","enisa_id":"EUVD-2026-29175\n","aliases":"CVE-2026-43995\nGHSA-qqvm-66q4-vf5c\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ccd65335-9777-3a62-92fe-35060ea74161","vulnerability":{"id":"CVE-2026-43995","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2) WebScraperTool/WebScraperTool.ts, (3) MCP/core.ts, and (4) Arxiv/core.ts. This vulnerability is fixed in 3.1.0.","datePublished":"May 11, 2026, 5:49:42 PM","dateUpdated":"May 11, 2026, 6:21:09 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-qqvm-66q4-vf5c\n","enisa_id":"EUVD-2026-29175\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 7, 2026, 7:21:53 AM","vulnerabilityProduct":[{"id":"1a292ec7-2691-3e5b-8127-4ac5a0659a95","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003c 3.1.0"}],"vulnerabilityVendor":[{"id":"b0c04931-aeca-3be4-8f6f-6d7faec3467b","vendor":{"name":"FlowiseAI"}}]}}],"enisaIdAdvisory":[]}